I have to set up, what I thought was a simple configuration of
Bugzilla.

We are a consultancy shop, and want to use Bugzilla to track bugs in
several projects and companies we consult for.

The basic requirement is to have several products (projects) and users
assigned to those products. The users should see only products
assigned to them (and nothing else). Also, they should not see other
users of Bugzilla. For easier bug tracking, and because we have only a
handful users per product, we'd like to have the assign and CC
dropdowns populated.

So, to prototype, I've set up the following scenario:
- products (project A and project B)
- users (U1@example.com, [email]U2@example.com[/email], [email]U3@example.com[/email])
- U1 and U2 'see' project A
- U3 'sees' products A and B

We are using Bugzilla latest stable (3.4.2).

I've set the following flags:
- makeproductgroups On (yes, create a new group for each added
Product)
- useentrygroupdefault On (yes, use Product bug groups by default to
restrict who can enter bugs)
- usevisibilitygroups On (Yes, restrict visibility of users to members
of specific groups)
- strict_isolation On (Yes, disallow CC'ing users that are not members
of a group that has visibility to the bugs for that product)

Onto the product/group/user creation.

I've created the products (nothing special). This creates the Product
Groups by default (because makeproductgroups is On). I set the Group
Access Controls for each product to be (for the Product Group):
MANDATORY/MANDATORY, ENTRY, editbugs

Then, I've created the users, and assigned each user to the
appropriate Product Groups. So, now I have in Users:
- [email]U1@example.com[/email] - 'User is a member of these groups' Product A
- [email]U2@example.com[/email] - 'User is a member of these groups' Product A
- [email]U3@example.com[/email] - 'User is a member of these groups' Product A and
Product B

Now, I move to set up the Groups. For each Product Group, I've changed
the 'Groups That Can See This Group', to remove admin and add itself.
- Product A - 'Groups That Can See This Group - Current' - Product A
- Product B - 'Groups That Can See This Group - Current' - Product B

Now, the moment of truth.
- For Product A, everything looks ok. All three Users are visible in
the dropdowns.
- For Product B however, I also see all three Users, when I should see
only U3, since that is the only user for Product B.

So, Users 'see' products correctly, but users 'see' other users they
should not in Assign/CC dropdowns.

Can someone help me with this?

Is there anywhere an easy to understand documentation on these
Products/Groups/Users permissions and settings? I find the official
documentation confusing - I just don't get the point of groups.